16529 matches found
CVE-2023-45809 Disclosure of user names via admin bulk action views in wagtail
Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any change...
GHSA-FC75-58R8-RM3H Wagtail vulnerable to disclosure of user names via admin bulk action views
Impact A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any changes, the error message discloses the display names of user...
Improper Privilege Management
Github.com/grafana/grafana is vulnerable to Improper Privilege Management. The vulnerability impacts Grafana instances with several organizations, which allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organizatio...
PT-2023-29699 · Wagtail · Wagtail
Name of the Vulnerable Software and Affected Versions: Wagtail versions prior to 4.1.8 Wagtail versions prior to 5.0.5 Wagtail versions prior to 5.1.3 Description: A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bu...
Torchbox Wagtail Log Information Disclosure Vulnerability
Torchbox Wagtail is an open source content management system CMS from Torchbox UK. A security vulnerability exists in Wagtail that originates from a user with a Wagtail Administrator Limited Privilege Editor account that can retrieve any user's display name...
PT-2023-29313 · WordPress · Dropbox Folder Share
Name of the Vulnerable Software and Affected Versions: Dropbox Folder Share for WordPress versions up to, and including, 1.9.7 Description: The issue allows unauthenticated attackers to include and execute arbitrary files on the server via the editor-view.php file. This enables the execution of a...
PT-2023-8843 · Foxit · Foxit Pdf Editor +1
Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader affected versions not specified Foxit PDF Editor affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader and Foxit PDF Editor. Us...
Vim < 9.0.2010 Use-After-Free
Use After Free in GitHub repository vim/vim prior to v9.0.2010. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid183414; scriptversion"1.4";...
ALSA-2023:5863 Moderate: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: grafana: golang: net/http, x/net/http2: rapid stream resets can cause excessive work CVE-2023-39325 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS...
Moderate: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 golang: net/http, x/net/http2: rapid stream resets can cause...
CVE-2023-44990
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin = 1.0.7.1 versions...
CVE-2023-44990
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin = 1.0.7.1 versions...
CVE-2023-44990 WordPress WOLF Plugin <= 1.0.7.1 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin = 1.0.7.1 versions...
Automated Editor <= 1.3 - Arbitrary Settings Update via CSRF
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
Mediabay <= 1.6 - Editor+ Stored XSS
Description The plugin does not validate and escape some parameters, which could allow users with the editor role and above to perform Stored Cross-Site Scripting attacks...
UBUNTU-CVE-2023-4822
Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor...
WordPress Mediabay Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)
Software Mediabay Type Plugin Vulnerable versions = 1.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-46066 Patch priority Medium CVSS severity Medium 5.9 Developer Claim ownership PSID 1892d46d1127 Credits emad Required privilege Editor Published 16...
Fedora: Security Advisory for emacs (FEDORA-2023-29df561f1d)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] Fedora 37 Update: emacs-28.3-0.rc1.fc37
Emacs is a powerful, customizable, self-documenting, modeless text editor. Emacs contains special code editing features, a scripting language elisp, and the capability to read mail, news, and more without leaving the editor. This package provides an emacs binary with support for X windows...